vmstat — quick reference
Snapshot and repeat
Default output covers processes, memory, swap, block I/O, interrupts, and CPU columns. The first line after boot averages since startup; timed runs drop that average when you pass a delay.
| When to use | Command |
|---|---|
| One-shot system summary | vmstat |
| Repeat every 2 seconds | vmstat 2 |
| Five samples, 1 second apart | vmstat 1 5 |
| Add a timestamp column | vmstat -t |
| Wider numeric columns on large-memory hosts | vmstat -w |
| Skip the first averaged line on repeated runs | vmstat -y 1 5 |
Memory views
| When to use | Command |
|---|---|
| Show active and inactive memory columns | vmstat -a |
| Memory counters as a vertical list | vmstat -s |
| Display memory in mebibytes | vmstat -S M |
| Display memory in SI megabytes | vmstat -S m |
Disk and forks
| When to use | Command |
|---|---|
| Per-disk read/write statistics | vmstat -d |
| Summarized disk totals | vmstat -D |
| Statistics for one block device | vmstat -p sda |
| Fork count since boot (single value) | vmstat -f |
Kernel slabs
| When to use | Command |
|---|---|
| Slab allocator cache detail | sudo vmstat -m |
Help and version
| When to use | Command |
|---|---|
| Brief usage | vmstat -h |
| procps-ng version | vmstat -V |
vmstat — command syntax
Synopsis from vmstat --help on Ubuntu 25.04 (procps-ng 4.0.4):
vmstat [options] [delay [count]]delay is seconds between updates; count is how many reports to print. With only delay, reports repeat until you press Ctrl+C.
vmstat — command examples
Essential Default snapshot — read the columns
Run vmstat with no flags when you want a quick health check. High wa (I/O wait) or swap si/so columns often explain sluggish hosts.
vmstatSample output:
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
2 0 594160 529316 112516 2244268 40 311 2362 14230 2664 40 22 47 30 1 0 0r is runnable processes; id is idle CPU percent; gu is guest CPU time on virtualized kernels. The first line averages since boot — compare with timed samples next.
Essential Timed samples — spot spikes
Pass delay and count to watch live behaviour. The second and later lines reflect the interval, not the boot average.
vmstat 1 3Sample output:
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
1 0 594160 529316 112516 2244264 40 311 2362 14230 2664 40 22 47 30 1 0 0
0 0 594160 529444 112516 2244332 0 0 0 0 424 307 1 2 98 0 0 0
1 0 594160 529444 112516 2244332 0 0 0 0 700 307 0 2 98 0 0 0Idle near 98 on the last two lines means the box was quiet during those seconds. Raise count during an incident to catch brief spikes.
Common Active and inactive memory (-a)
The -a flag splits cache into active and inactive columns — useful when deciding if pressure is reclaimable cache or genuinely hot pages.
vmstat -a | head -3Sample output:
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free inact active si so bi bo in cs us sy id wa st gu
2 0 594160 529316 2017792 2377884 40 311 2362 14230 2664 40 22 47 30 1 0 0Pair with vmstat -s when you need human-readable totals.
Common Event counter list (-s)
vmstat -s prints kernel counters as labels — handy when explaining memory or swap to someone who prefers words over columns.
vmstat -s | head -8Sample output:
5419864 K total memory
2848312 K used memory
2377384 K active memory
2017792 K inactive memory
529316 K free memory
112516 K buffer memory
2244268 K swap cache
2536444 K total swapValues are in kilobytes unless you changed units with -S.
Common Disk statistics (-d and -D)
Use -d per device and -D for a rollup when investigating storage bottlenecks.
vmstat -d | head -8
vmstat -DSample output:
disk- ------------reads------------ ------------writes----------- -----IO------
total merged sectors ms total merged sectors ms cur sec
loop0 14 0 34 32 0 0 0 0 0 0
sda 126160 …
29 disks
3 partitions
366980 total reads
1461129 writes
1596 milli spent IOFor per-mount I/O over time, also see iostat.
Advanced Partition stats and fork counter
-p focuses on one block device. -f prints forks since boot — the number only goes up.
vmstat -p sda
vmstat -fSample output:
sda reads read sectors writes requested writes
126160 7007924 136354 11248312
18021 forksPick the device name from lsblk if sda is not your root disk.
Advanced Units, wide output, and timestamps
-S M shows memory columns in mebibytes. -t adds a clock column for correlating with logs.
vmstat -S M | head -3
vmstat -t | head -3Sample output:
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
1 0 580 517 109 2191 0 0 2359 14215 2662 40 22 47 30 1 0 0
r b swpd free buff cache si so bi bo in cs us sy id wa st gu IST
1 0 594160 529444 112516 2244332 40 311 2359 14215 2662 40 22 47 30 1 0 0 2026-07-01 18:07:10Use -w when columns truncate on very large RAM values.
vmstat — when to use / when not
| Use vmstat when | Use something else when |
|---|---|
| You need a fast terminal snapshot of CPU, memory, swap, and I/O | You need per-process CPU hogs → top or htop |
You want repeating samples with a simple delay count syntax |
You need historical daily files → sar |
You are checking whether swap in/out (si/so) is active |
You need per-mount filesystem usage → run df |
| You want slab cache breakdown on a suspect kernel leak | Deep slab walks may need /proc/slabinfo and -m with sudo |
| You are teaching column meanings for procps summaries | You need GPU, network, or cgroup metrics → specialized tools |
vmstat vs sar
| vmstat | sar | |
|---|---|---|
| History | Live samples only | Can read archived sysstat files |
| Setup | Installed with procps | Requires sysstat collection enabled |
| Output | One compact table | Many metrics with -u, -r, -d, … |
| Interval | vmstat 1 10 on the spot |
sar 1 10 or sar -f for past days |
| Best for | Quick ad-hoc checks | Trend analysis and post-incident review |
See the sar command when you need long-term retention.
Related commands
| Command | One line |
|---|---|
free |
Human-readable memory summary |
Browse the full index in our Linux commands reference.
vmstat — interview corner
What does vmstat show?
vmstat reports kernel activity: runnable/blocked processes (procs), memory and swap usage, block I/O rates, interrupt and context-switch rates, and CPU time split (us, sy, id, wa, st, and sometimes gu for guest VMs).
The first row after boot is often an average since startup; timed runs reflect each interval.
A strong answer is:
"vmstat is a procps snapshot of processes, memory, swap, I/O, and CPU columns from /proc. I use delay/count for live trends and watch wa and si/so for I/O and swap pain."
Why is the first vmstat line different?
With no prior interval, the kernel exposes counters summed since boot. The first printed line is therefore an average over uptime, not the last second. When you pass vmstat 1 5, lines after the first cover one-second windows.
vmstat -y skips that initial averaged line on repeated runs.
A strong answer is:
"The first line is a since-boot average; interval lines are per-period. I ignore the first row or use -y when I only want interval data."
What does the wa column mean?
wa is the percentage of CPU time waiting for I/O completion (I/O wait). Sustained high wa with low id often points to disk or storage latency, not lack of CPU cores.
Confirm with vmstat -d or iostat.
A strong answer is:
"wa is I/O wait CPU time — high wa means threads blocked on disk. I correlate with vmstat -d or iostat before blaming CPU shortage."
When would you use vmstat instead of top?
top lists processes and is best for finding which PID consumes CPU. vmstat stays at the system summary level — better for spotting swap storms, I/O wait, or context-switch storms without curses UI overhead.
A strong answer is:
"top for which process; vmstat for system-wide CPU/memory/swap/I/O trends in a scriptable one-liner."
How do you install vmstat?
It ships with the procps package on Debian/Ubuntu (apt install procps) and procps-ng on RHEL/Fedora (dnf install procps-ng). Verify with vmstat -V.
A strong answer is:
"vmstat comes from procps or procps-ng — usually preinstalled. I check vmstat -V if the command is missing."
Package installs and updates in this section use dnf command.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
vmstat: command not found |
procps not installed | sudo apt install procps (Debian/Ubuntu) or sudo dnf install procps-ng |
vmstat -m permission errors |
Slab view needs root | Run with sudo |
-p shows unknown device |
Wrong block device name | Check lsblk for the correct disk |
All CPU in st on a VM |
CPU stolen by hypervisor | Investigate host oversubscription |
High si/so with swap used |
Memory pressure | Inspect free -h, workloads, and swap sizing |
| Columns do not match old docs | Newer procps added gu, changed headers |
Compare vmstat -h on your host |
-S numbers look odd |
Unit letter matters (m vs M) |
K/M are binary; k/m are SI per man page |
